CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
Read original article ↗AI Summary
A critical vulnerability in Canonical's LXD and MicroCloud, tracked as CVE-2026-112816, allows attackers to impersonate trusted clients without possessing the corresponding private key by exploiting a flaw in mutual TLS certificate validation. The vulnerability arises because the server validates the entire certificate chain against its trust store, but only the first (leaf) certificate's private key ownership is proven during TLS handshake, enabling an attacker to chain a trusted public certificate behind their own. This could lead to full cluster access and potential root access to host machines if a privileged account is impersonated. The flaw affects specific versions of LXD and MicroCloud, with fixed versions now available, though no known exploitation has been observed in the wild.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.